CyberRota Analysis
AI-GeneratedMongoose versions prior to 7.22 are vulnerable to a critical desynchronization issue that allows remote unauthenticated attackers to exploit the handling of HTTP headers, specifically Content-Length and Transfer-Encoding: chunked. This vulnerability can lead to unauthorized access or modification of resources across different user contexts. Organizations using affected versions of Mongoose should prioritize upgrading to version 7.22 to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.